The Online-Examination-System’s admin/admin.php file contains a function named isAdmin that performs no authentication checks, allowing an attacker to manipulate the call and bypass the required credential verification. This flaw permits any remote actor to invoke the function and gain administrative privileges, potentially exposing sensitive exam data and system configuration.

Involved vendor: itsmeravitejak. Product: Online‑Examination‑System. No specific affected version can be identified because the repository uses continuous delivery; the vulnerability is present in the code at commit e6208e630b14657999bbfe4c9912302d2a1e2449 and all earlier releases until a fix is deployed.

The CVSS score of 6.9 reflects a medium severity. EPSS information is unavailable, but the public release of an exploit and the ability to launch the attack remotely indicate a realistic threat. The vulnerability is not listed in CISA’s KEV catalog, so no known large‑scale exploitation has been reported yet. An attacker could use the missing authentication to elevate privileges, compromise confidentiality, integrity, and availability of the exam system, and potentially pivot to other internal targets.